From 107def2e6527f605f1108829dd850fa46bc65b62 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Wed, 9 Aug 2023 16:16:49 +0000 Subject: [PATCH] Bug 66425: Avoid a StackOverflowException found via oss-fuzz We try to avoid causing StackOverflow, but it was possible to trigger one here with a specially crafted input-file. This puts a limit on the number of nested children in place and logs a warning when the Stream is not fully parsed. Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61256 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1911577 13f79535-47bb-0310-9956-ffa450edef68 --- .../hdgf/streams/PointerContainingStream.java | 25 +++++++++++++++--- ...nimized-POIHDGFFuzzer-5947849161179136.vsd | Bin 0 -> 12310 bytes test-data/spreadsheet/stress.xls | Bin 63488 -> 64000 bytes 3 files changed, 21 insertions(+), 4 deletions(-) create mode 100644 test-data/diagram/clusterfuzz-testcase-minimized-POIHDGFFuzzer-5947849161179136.vsd diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hdgf/streams/PointerContainingStream.java b/poi-scratchpad/src/main/java/org/apache/poi/hdgf/streams/PointerContainingStream.java index 3f3192f9fc..c4a91ad969 100644 --- a/poi-scratchpad/src/main/java/org/apache/poi/hdgf/streams/PointerContainingStream.java +++ b/poi-scratchpad/src/main/java/org/apache/poi/hdgf/streams/PointerContainingStream.java @@ -17,6 +17,8 @@ package org.apache.poi.hdgf.streams; +import org.apache.logging.log4j.LogManager; +import org.apache.logging.log4j.Logger; import org.apache.poi.hdgf.chunks.ChunkFactory; import org.apache.poi.hdgf.pointers.Pointer; import org.apache.poi.hdgf.pointers.PointerFactory; @@ -26,11 +28,15 @@ import org.apache.poi.hdgf.pointers.PointerFactory; * other data too. */ public class PointerContainingStream extends Stream { // TODO - instantiable superclass - private Pointer[] childPointers; + private static final Logger LOG = LogManager.getLogger(PointerContainingStream.class); + + private static final int MAX_CHILDREN_NESTING = 1000; + + private final Pointer[] childPointers; private Stream[] childStreams; - private ChunkFactory chunkFactory; - private PointerFactory pointerFactory; + private final ChunkFactory chunkFactory; + private final PointerFactory pointerFactory; protected PointerContainingStream(Pointer pointer, StreamStore store, ChunkFactory chunkFactory, PointerFactory pointerFactory) { super(pointer, store); @@ -58,6 +64,17 @@ public class PointerContainingStream extends Stream { // TODO - instantiable sup * those if appropriate. */ public void findChildren(byte[] documentData) { + findChildren(documentData, 0); + } + + private void findChildren(byte[] documentData, int nesting) { + if (nesting > MAX_CHILDREN_NESTING) { + LOG.warn("Encountered too deep nesting, cannot fully process stream " + + " with more than " + MAX_CHILDREN_NESTING + " nested children." + + " Some data could not be parsed."); + return; + } + // For each pointer, generate the Stream it points to childStreams = new Stream[childPointers.length]; for(int i=0; iof{F(XEfgui00(;z!LC@bq1gKo zdpVY1mviLAu1E0%6bnR601;G@{jcb`);=XKagNxO@aG&^$1@Z>099gSmO)hy@6%f@09@f@_%;e_@B-GzstQI zKVXk1kHkb_;$Sk)IS-QwCR0pin9MO*V6w#22@{P8F9EQ^WSoB^+2ZTYnC$+p?%(C- z|F{3YI|AcChJU%hz;MXIXF1Hov-e*wc6i17jbj2oX6b6W9cYxF|7!on7iAj-4HwQoeD@Fk zCO?Dz`hH{I#`68G|NEm+J~#fQ$S0)bq{*1xQKS1X!SeY0w5$|MqqyV3`94NP2y9^- z96sI+J#YpX{nvBvlNv$f(9n##TmbB+X13+4j)&TtU`at^lO0uHhgVb=C}5$ovJzgu ze$7I4bv2wgaY755H*a=<0!U_)lVSAe(cq)-@c~Ci$M4;K(?Z5e3Rnj`r10n?Oc&O$ zCUo7GkI+S3`)=_DhQZ|PfBh6>V z$tGsTXY~QngXrW#D2QpCjStNc!2Ee6jq(79bcy zZXnn5Hjt66_;8-yK$?_NrlnN0St(^+N?DXrmiVSqDMgo3{8GxQl-grmO4CW|H*TmKPZ!GE6V%%%y7dG-8@AW2uxkX0+hAMSov7@7 zk*sv_C-m$uz4ozCO6-EEL=g+4iQVuHZD+w3ErM&XkcFjC3@)(Ne;~FhyNR^<;E(2J zt2_9;Kp5TMd%<W*S!FtVLl=lG< z8&SZ?elF6ACJRn>T?CVmaBB$1kAhn(gtk7B;titZlJlaY6CRUS3GfSAA8HAN6`;%r z#TW#GxkJ#lh@%l#A|6D%9z89lm`sTrAre28%n=x3R&|)moMl*4yq#`ZPQM>_SaeTT zpWMH5eR5R4afWGxVH#;jS;X@VC7{R>77NpZi3PH2#StR7a7cDhmVzR>3f`WaKPFvH z7ZF?X_897u%3eyV6lJZMWtH4ntvOxtT622kwPr5@k5OryA}+_l8|IU0zKJw05^K%O&C*llKk0Ngr5ba$Sxhb7Q6lhI2_(R!H( zVi(yzp+}{p@z9;!`LBZ(&CnAR$B%&MF_yqs0oj=#e=Z?jwv&Uom5gfOU{RmsdRgSA z@<)`O@Xn9&S~#@W(JX9%eDj*i(F@&u*&B_`RmP!yp}D5>HZNj3vw$K zR&1;|SaG2O9#_;>G*{dzmn(~urAmGUBT)8M4pC03xD)MGp}eew`^s0!Hl?*{SNW-O zk!mIvCaVgjpMsVxk#~wz<*NNElV4P~RkvfhYgBp_t#(m^k9v%{tI9()TfIVEu0Ey~ zUseC9exv@ZHrJ{q^ysC9!P=49DO#C!sdlY)kCs$|BkRTvU`HyaC~s>2&}y`xuh)lZ zbSBt&5(0|=Yu%h|87s?xut+8ttF81A(p+YcH!BQc#!KaCMnx7WPs_@cD&#OKGRkX6 z4StFZ`KFpkC}uP|QmgA|sbSljQZHczg|*S!H?6e_ZQEDMGh!%r8`6`*xdsy;xC!U+ zT1UJDP!T4x6HHWuX#xY=Py;mvx8l6#!5Y{~Edw=3mq9mVd*sbW3c?zi7x1jj?t^R% zuAA}Zqn;hE*Xhu52)0^ESgipz&NL)LmYV zSKxF<^ir0qE9gfLqa)~eI)^T%S5h4R6~uBN^V?17vmC`@)Lz1(cKt++E-E!Ghsj}Q zW+uoo7`c?qmP>P_S-CkZ6Q4DcNl(jSlNebtlP#CAiPD@LY(y9~IWH?QH%*qs_6H_d zmY0yhN<9)Y(h}1dHdn^PCnez*<|TM!$EQg9W0k^&eVa2=c<74fU!!9U%@o8^=*4FQ zrkx?x2C4Df)uOj8A%D#tD{{AFwW5$;V*79SP4nu7FGn51xhIO8YHo)8aH1d2Fdg=w zJTt#hE zR1;dy;{fr6AiuzSARU_sjtSzSHo}3=;kWmoEKRC`C>SL+C;)4JJ!=T!e=#!;DuB2j zf@In3OnF*LYA(~84eG;q4IVs@VZVD7K{8gJEtALN0b;ZIGfY5624je`&cTD5Bb6(D zk|y;BgM%Ee1OE8b_-tu^HZ>#L#m#GwaFNdd7{(Xz?a&rJsuNaNr*hLc)nJ)`e!Wk0 zx=Yb_u}$3#>?X7imY`jru){V(4_i2(=D>B7(Tt+u5IFs6&yz!Zg;fZ)xZQgqu#m&g za2G~$41*Y?1d*#5#Wy2d%qB9V1AhWj$Qceqe@_(P?oa>Z8Rk;p(!JN6&7R^uXZv;H znae?r9!+E_4IK;uFI0JC7=IZ&uo3RJ5zaYcBaDQl*|3BI+};)Z>4-t5FFvPHd__?xF*D7LIb2z;SUAS?n0_GaMG3 zzBEuRTJ4A60QRcu1`-#9)qomoA}zPOWOE|y1C)4#Ho=-m@vDSLv3I1HLRTR3(icG3 zJK;Y!P=}xjJ0>pB32TRSAzmE>hvJ{^48;L??Hb)t%HKxMcCbW88s`o}#8E-A9BnQb zd?#AD56@zArE(@WRm$iSZ;6@soE%vqn--rdO=9xXzUHPr5o1BgmY2(nVo=Jj297#` z0E0~##F?wRyScf!^CSBU$6ex|mgDXw?;hQ8D*QSBN`Ogl-Ygq1JnTKuin$+}6duLM zE+#hx<>X4U4PmF(QT*b7%pQ`CP}?40Ww;VxI!>A+%ab4ZA_ha?M5`h9L$luGWhOil zr$=T>Wo_9R(iQyad1>-TjpAHcjX3jBWUh2-Q&4VvPI@Un>$C0(g9;9e*cW0=nnpq# zYu+PLF3Xn6HMwc0#txcjB^)oEoBJdvFDF-)`6-~IZ_>2!QYJ^5A(bXJ1mtYDzE2Qw z_h4QJLnbhsg2JJE=L3_yARqJz4b8RRG%KrCRvN|f)w6q|j~_*6^)1R#?5f|0LGRQ` zA*)B*IOFe&B2RZFMctiArS4Oc(ub_{<$P>uQwDQ160C5)DYCH!Z8L?X3OmvyLLAzj z?nD1TkESKGf2Qdo7SSbz^g7zG8J4oBttcPqHyi^+FWyw?qJW-fs2#aLY%!PhC@hGwe1%|-mS zrRNbq1duH{&YO?s>EPN09Lxdxm`-(H5QrfV*eFgnl!rqP$hAh-#i@pU+3xW7e?Q=M zLr08%o7Ct&&#GaK&vBp|i*Z!0!5KAZapYp5PFDrN*b`-)k<0?V0#~CGVNkQXqRkm? z=m+*1U9i6oxVJl_(?3vSX-NDFof&b+--;1o8Vd!ANUX{Wh+$gYhuW_QIyW?TunjC* zLkPJy{IGG|~v zyl%CE5TovUt2(W&SM#7v%{4$uPb2h>0;$47F#(XEhRzXHI)isx+GW|BY& ztW6X6aPI@6w&5n6VfMgyF)rLm0vE1{$t-FH_iU=*Dba-w35>uRZ9ib8M=o45>vN9O zIY$n4&c2JaiNLm*Uk7vTKcLR0sIS>MNAq*`C4vDxY;>Y9k72zd@0!=4bBT2M8P~0xiwriMSNqff_iaW`rfWAFQ)esK0tzKM zgB_hU;ZRP(7DDz6ve1nFM(@Vx+|xD zOD#)40&9-k*GZ7$WBNtzwLcuQkPXt@7x-PdZ$9!MRHHlRx|@I2%Mnb^cw1LsmprV> z+d}2-*bmGe`&z2JU2EZvS6g48Ro>pP0QLmxg+uhh4zIp?q3c1t&`~e6)(g$_LTb!) z;RvX57G@#4U+GzIKBj~N5oHA@=qXk`#5iyvgFuaLA|JTVfcFASoQ2V*;b4{m7SqL+ zr-ad+cJt}$LjH51RkiTo123CbLfcyC+$ywN6CpnN3{nFuHM(m(JMN8#lP~aH*Ylw| zQA!7kYKg}ohLg@hohqU(qN`V1uy}OOwIx+a-siXzdQ4~%b0{ZCf62+|;$X=H$thvF zByz4~X26+u1OajDV;oM7%tUP;W`C1$euCm#wKnYZkf@SNmUV5jbxvYSD4 zYXnbnGD5saHhDaRopp&aIWL6k!qvQI#0btEbCYM->ed(r^?3PBTdP@-_`AB+-V=#y zo#a}P`1&tB_xBE_TU|s&Dh3`=SCiMHg&ZQSf*ZI5@AO z!XXM)Wab4#p@@iQkTkqgur$C~h{6K`#;SybdYUc=>12draQBmwf1W@eddL;KDF!G) z6)|%;BU{&KvK57jb&9=;vkLfCQKR^vfRdgiWfguUVI>8VOEOC4m1Mx$l07A(2m&sa zs7mTeT1q(O_T_!be<+91<&urDtLl$2USap;z1i$gEIQ)K$Q)ic=LgE5@od75a(=%c;vwu1a4e%aY;B zAC;L(EP1PyyOgJtH=xOwfqOwXq7|-)2myztx@e(omSmaJypF^ zfkDMryQ+QFceIn#)6{d+wJX(&7p^hzCz!MsVro(h3qF%_X)ew3V&9aE|9dm4;zpHe{XqP1$t3vGxGiXzV@bUSuL1XA+4-{+xgiuP{cEVvveWF6eZ;-gs8hc3Hrc4U3KFemYg zYyLQkQJq!`_m&#=#G$n0d&lDmdGhgia(1%8H6KHRo^e<$zKmOh4fLCYwAGDqEeW9b z3tbEfJNP_~tV`g$Ng&@OpvIO2vLykraadypb7t;|<64AF8P;hUt z0cm#wjrIl*;2DIZ6#W89uXgN!dNL9>IELUvHZ$3uFAE1sYuKr}! z^|<{3u|we@VdyU5Q@rpEiVF>=;mLrUsJ_a{uye`J4l}2e^sl zd1YPJ3LWi_n-L|eh;r|Z8RIe?^YSd?^0u1)ev&M(s!lq-*RK7@_J=2{P8L{;4OaVC z3vVB-I!fL-#x=c+3Z5K&c+~bi#+Bz+)2~`_pH`+{eOZk%u9)6$xLKBWm3|7al^fT- z>-0l(WcWHHMcT0te;yfhktiNw?h+rJT!fE9#WgA|Ge-1$0yV>kcmD{I_D)L|( zc&mfe6V$2dS?cBLZR(?H+bik^&n!w-QRUuW?#jnkzKQ?xe9!zLonObzzOXo$bzL3S zoe_)Axz>4GyBDuIsv-&ZMHa(R0dN2OQ^yl;aC+}jaSE2e`O4JG1#nmUvVNGgR(tqh zQvqUcANpk=fr0X4v4PqlR__TUfb;3+kjR)MUR+bNzWFO_Vo3|kg7_%WzBl@v_dx&? zcxIlz)BQcg9O=;I7#_L%K-%o6p$E4Be|0a<$W+@GyLglQERbnQ&=-FR#RMO(f5!w6Ab=)2nJTogkQz&8r zMNy(;(cPVM2X=a?ZdG^iw6iZPxmuS!$O&qMUfLjSv^GUMQ@c#NRm)Up-BjTbpS80i zh>|$jH8>-mee0p@Zr*lPO2OT{6D%Ux{HK@C$a^n1ouj?drv$in&&Z<|_%5o~E6ilD_m%S|*93A3VEEFBWYU9Ts(Y_sDN#&+@g{=jif$(44iVe60vYSaj|a zPRuU#ikPK<=!levor+~*k5#g3zB{)@Kt;smi2D&gW1H3>89!l8DQv08mnbU|B`+(K zl1-8W72unRFYRW$CQMsZ)D!Xwf+yX=pZwQ32p! z2^ehr9UAh*h-G{i40p!W=)8Jk=teg*cmJ!waKLb>JBCXaj1A0cbowzb+YtsV7y{gc zsCEIW!<|9~MnqM>219rJuF+jEp8E!eCV(XBt25eTZ-he+g9VW51~+e-uGUe0&IW&Po8@V{t$_D3s z3q@tM!Ayb%V`!nn9$IxjrR79s#N&`&CJy$E&uyETAsuEBEX~f$uQ{3dY>|i zlrsLrsI;s$X_QQXf-koJiBh`xAi~vc&Z9_tR#r2D7d)!^nW2WYVlWsjUqR zTu=V#X&(bHcs+^ZXj!>(Sw>Dk4jZ18otK*fKGoUDq%@~9|1xhxo+dLprE??)BC>*0 zaEPO|sWaK%XT8Hi-}Mdy);suVbmLQTy!czH3`carK`NIf0eoGBe(jtq%Vsh}(&Su# zvgch|brNIVEa$Gnh3EWsaQo8bwS67Jz_^0&0p|gX#Q;Ws(2HsCVjg)h54@OL_~wEa zbJUC3?ZvFYH$`5|PhQLvFD4w{4Dw=ndogxi4EK^3(+ECLUCdlMSj_A!W)>DRxy4M} zh+<|`F(WEw_PX>fW?H)yGnT~+1+K)SZ3 zx^}T3tm{3F6aElq9Dku66NFLfM?#l29Veb|XK%7VU{No4XWI$>Q^No8h&vEa+}HmD!tJ_Cr98*}Xb(dG8(%pSBJnd^_4}7UJNrDu!%q(mS1jkN1Nh z-xy&E(&(J?;iF#RjH+?;W~4^f+I>DGrGvxwuOLU^ohF~Kwqh1xP2!9Wbf@`ikjo+{ zN(c8Z0^2@kpy)A!d>d*0&p0oe4-eX$wdi>lID?<>YB&RoMKHKI;%L+gjn4ZFygMj3 zgpNx14O*QjA9kxdoY8Miwm9cC_t!JvM07(M1^?j*90$q=bPhJy?zi4$jX~E&n+y2D z9Bs6@gU_Fua78`7Scfax@p+E1g@x-b>oQ_Grd`%TSD20uyR3KP7Gd~21@Sl9#JbM5 z+i7FD-fkAIvFfzmZY4g`>+N>p)02U?216z2xhsgblK@Lkn?l=>(>2NTLOwvbKp{cs29x zP(N|C)4(8eE5p!0E;I4$@kZ`dw-?ir>gVst(-m_{*~}HkZd@0I++#0P(?9*#h5723&Ufs!*N(JnnqxOl|EyKJ-TX7F?9|ICyp4*mrm-U`Vk_js zb;YdUO+vql6)KS;?OA5PBSX^^r<zs)B^{{kOO1 zN3Dyj*;{YnS~l!%*wLVUDT-Q1QqJ?(f`V0kT|+~5%u~nQx$$c6_+w2|MB#y-W>e1` zt<2LDKbB7U@QBq`E8EpdZJ4fjTg=PPn^^Zpq7X?^{kpHW{qL{RYo9WM*{cslA<2Se z*II(_)|B_#YBx35x$TYVhkeVV`Vkdv{od3!$G&Zin$^;C_U&WlX$HT7=L-f`g;eZN z)z5d2))gO94_@IwysoZfFR<>e>yuB5LUPrOlyvW!ClKgTUO1v{#)SrzdzrF4=DE8S zr{uCarmNDhI9++Kra88~JZ)*F?!)~@{G^kDFfms;wtThG<^Pz6-~5Sly~^LLfPFV{ zrzm9epnh$(JFKcJ=N_B+E`{^Q{=;hbGDA?fYTlyC6C*Q5Zob(Zs~kfe51sOA=<`#e z!|6MIYggH6duu!7sk&kaZ?Lhv#NH8wWOUy(jbYt(i$Y4Shyqy?xF-sk!G2c#(ahT- z)4G=}HmJh(_d7DNv_5L>di9}ay&9^TW9NKQnUgUIj(hn@AMymp0y+{e8`Hr%Oboi> z1nx9@u4xr33Q^BlJmSNBcCRR8!`}WI)Ajn8qaUW&4vb&%d963=Ue@*fj-BS8Tc5b7 zV_v78FO+|kRQGx=eK+UEPQ&SoFB#JnGkc#~RmL7+2NnGi;6xW(K&@(pz$1TXBm5kv zwr_1JS~8{9wr^WR<(fK>uf8#6w*H0J$4a^G0^4S|HTj9!P9U76HtbtI%xAn1r5~Nw z96MUBovq#N#GS`aS~$DR@~v)5lYYoeS0=b|*cm%j%@-xJByLHZR>U&h(c&wc_O-Jj z#{Tm0poPs{HKJ5rf$zismxO17b_5O#>?ar|Nae{N`M}kJ0m;Mb=g)F^x8#Pc*6hoW zeTITg?J4YU>3i0SLjLTgeRim+=KiW<4;QL5jdP~9;!nRfLVLYslV!lx-SZc}Ih`6h z6}86X>n67K`>^T-(?uw54Zu+B?vs+>vtm>x14^T76GK0ZuBI#zJ=`vX zQ8`5DGW4f>3wkGmPbQJ5xhYssCr2-~;GHdSm{iuklp{@fFqj$+a<0|O5xXCA)pmfp z`;{Dh`h3g`4seTJ%TX)(h9Jl7~1vjczQSkQ9Oprw-URHl69w84uMGq9mHn7r$<; z5qz*Sxoq;Gso_(DU;#&F4GA26zAf@}iLkNlIn_4Ey$2QK&I#%zvo*=LD`NKJu6z00 zm~L=43vxH_9@ML`>DCf##KRugnArZ!A^h*0|8s-pzq>W^d#|oWhx_l!zvktCy(RHq cKl{&H{9X6|r45q*{4M|Iwf|50|L=7AAM2Y?4FCWD literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index e084a6c0b23cf7dee3c32553d4d9b553c520a715..b8bae8e3d9f5ea94773b646a26ca5e4e0c61a95d 100644 GIT binary patch delta 643 zcmZqpz})bKc>@a*XB7hj!@vLk|5tD3WxCABSULGFv-~8M9M%Vo@40VIE@WwEs(QWo z7t1kbPKKTLxNn}i$;dp}vC(`JXNSH7Ul~v{0~dp9MRICENoIataVvuWL*%*13oOD| zpEENsq;39fA*;ZYB)(ZH@{t&qCj&!DW@36#V(w&vd=(=XcQ?1vs;bl?T~kXFa|;to zLo-7|b4x>GGrh9n6ix;P51*X`9R3TG`aP&>g3LADnd8TGcf$P!N5@Pkbz;x VOQ4F^oA+OHl${*VXt3xD3ji~4o4No1 delta 238 zcmV000003IIiTV`Xr3X>V?Gg#Zu$iOiFr zI93JN0{{SHv->z5AOhkRvl?0A7PEYCvJW1m00009h5!I@lmGyEq5uFPumAx4y8r;G z$p8Qi%#)AUP_vwXdk_Jovlx-RL$eXpxB&~-01f~g0ssI|08o?Y*FFoQ000000097_ o0Hc#q^(d2B*d!7N&Hw-?*8l*Z-v9vU=KugO>9dd6K^>y@1pdlZrT_o{